CVE-2021-38136

Vulnerability

Corero SecureWatch Managed Services version 9.7.2.0020 is affected by a path traversal vulnerability in the /it-IT/splunkd/__raw/services/get_snapshot HTTP API endpoint. The snap_file parameter is used to construct a file path without sanitization, as seen in the snapshotHandler.py script located at /opt/splunk/etc/apps/securewatch_analytics_tdd/bin/snapshot_handler/. The handler prepends /corero/snapshots/ to the user-supplied value and opens the resulting path [1]. This allows an attacker to traverse directories and read any file on the target host.

Exploitation

An attacker with low-privileged access (e.g., a user with the swa-monitor role) can exploit this by sending a crafted HTTP GET request to the vulnerable endpoint. The snap_file parameter is set to a path traversal sequence such as ../../etc/passwd to escape the base directory. The request is processed by the GetSnapshot handler, which reads and returns the file content in the HTTP response [1]. No additional authentication or user interaction beyond the low-privileged session is required.

Impact

Successful exploitation allows the attacker to read arbitrary files on the target host, including sensitive configuration files, credentials, and other data. This leads to information disclosure, potentially compromising the confidentiality of the system and enabling further attacks. The attacker does not gain write access or code execution, but the ability to read any file can expose critical secrets [1].

Mitigation

As of the publication date (2021-08-06), no official patch or fixed version has been announced by Corero. The vulnerability exists in version 9.7.2.0020; users should contact Corero for updates or consider restricting access to the vulnerable endpoint via network controls. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of writing [1].